Tools & C2 Frameworks

Open-source reverse-shell C2 framework (t3l3machus) packaged in Kali; HTTP-beacon shells via HoaxShell.

Open-source Go post-exploitation C2 using HTTP/2 and HTTP/3; abused by UAC-0154 against Ukrainian agencies.

Abuse of cloudflared / TryCloudflare tunnels for malware delivery (AsyncRAT/XWorm) and persistent stealthy access.

Open-source PowerShell/Python post-exploitation C2 (MITRE S0363); BC Security fork with Starkiller GUI, used by Turla, APT33, APT41 and MuddyWater.

Open-source Python protocol toolkit (MITRE S0357, Fortra); secretsdump/wmiexec/psexec/ntlmrelayx abused in AD intrusions and CISA advisory AA22-277A.

Open-source Go TCP/UDP tunnel over HTTP+SSH (jpillora); abused to pivot through edge devices (Talos UAT-9686, PYSA). Not the same as Infamous Chisel.

RansomHub's BYOVD EDR-killer that drops a vulnerable signed driver to disable endpoint security.

Modern open-source C2 framework

Open-source .NET C2 framework

Lightweight Go-based C2

Adversary-in-the-middle phishing framework

Open-source phishing framework

Hak5 device management platform

Modern open-source C2 framework

OOB interaction testing tool

Tunneling/pivoting tool

Rising MaaS stealer replacing RedLine

Premier penetration testing framework

Windows credential extraction tool

Extensible multi-platform C2 framework

Weaponized remote admin tool

Commercial advanced C2 platform

Emerging C2 framework

MuddyWater custom C2

Evasion-focused C2 framework

LLMNR/NBT-NS/mDNS poisoner

Retro-themed C2 RAT

BishopFox open-source C2

Chinese-origin web-based C2

Chinese-language C2 platform

Go-based cross-platform C2

Chinese C2 framework